Granted Patent B2

US 12,639,449 · App. 18/418,711 · Granted May 26, 2026

Inventors: Barel Tayouri (Jerusalem, IL); Amit Chitayate (Tel Aviv, IL); Ariel Shuper (Kfar Haroe, IL)

Assignee: WHITESOURCE LTD.

G06F21/577G06F2221/034

Abstract

Claims (64)

1 . A computer-implemented method comprising:

obtaining a collection of entities, the collection of entities including at least one source code file and at least one non-source-code file;

identifying at least one bundle within the collection of entities;

generating a call and dependency graph of the collection of entities, wherein the graph comprises at least two nodes each associated with an entity, and at least one edge indicating a calling relationship between the at least two nodes, said generating comprising:

generating an initial call and dependency graph, indicating reachability of each of the collection of entities starting from at least one entry point;

pruning the initial call and dependency graph by reducing at least one edge according to collected heuristics, to obtain a pruned call and dependency graph, wherein generating the collected heuristics comprises:

obtaining a plurality of training collections of files;

for at least one training collection of files from the plurality of collections of files:

obtaining an estimated reachability of the at least one training collection of files;

executing the at least one training collection of files;

generating an initial training dependency graph of the collection of files, indicating reachability of each of the collection of files;

pruning the initial training dependency graph according to collected heuristics to obtain a pruned dependency graph indicating enhanced reachability of each of the collection of files; and

updating the collected heuristics based on differences between the reachability of at least one part of at least one file from the training collection of files and the enhanced reachability of each of the collection of files;

adding to the pruned call and dependency graph an edge that was present in the initial call and dependency graph and eliminated during said pruning;

obtaining information about vulnerabilities associated with the at least one bundle or any of the collection of entities; and

providing an indication of at least one vulnerability reachable by the pruned call and dependency graph, and at least one vulnerability unreachable by the pruned call and dependency graph.

2 . The method of claim 1 , wherein adding the edge to the pruned call and dependency graph is subject to further training that is utilized in discovering a call by a first entity to a second entity.

3 . The method of claim 1 , wherein the bundle is at least one item selected from the group consisting of: a container, a virtual machine, and a file system of an operating system.

4 . The method of claim 1 , wherein generating the initial call and dependency graph and pruning the initial dependency graph is performed using static analysis or reverse engineering without executing code comprised in the collection of files.

5 . The method of claim 1 , wherein the non-source-code file is selected from the group consisting of: a configuration file; a setting file; a file containing information related to runtime of an operating system.

6 . The method of claim 1 , wherein pruning the initial call and dependency graph comprises removing from the initial call and dependency graph vulnerabilities indicated as reachable.

7 . The method of claim 1 , wherein the collected heuristics is based on additional data.

8 . The method of claim 1 , wherein generating and pruning the initial dependency graph uses an adaptation of “meet in the middle” approach.

9 . The method of claim 1 , wherein the collected heuristics are generated based also on a plurality of use cases.

10 . The method of claim 1 , further comprising repeating said obtaining the estimated reachability, said executing, said generating, said pruning and said updating for at least one other training collection of files.

11 . The method of claim 1 , wherein the least one training collection of files is a package.

12 . A computerized apparatus having a processor, the processor being configured to perform the steps of:

obtaining a collection of entities, the collection of entities including at least one source code file and at least one non-source-code file;

identifying at least one bundle within the collection of entities;

generating a call and dependency graph of the collection of entities, wherein the graph comprises at least two nodes each associated with an entity, and at least one edge indicating a calling relationship between the at least two nodes, said generating comprising:

generating an initial call and dependency graph, indicating reachability of each of the collection of entities starting from at least one entry point;

pruning the initial call and dependency graph by reducing at least one edge according to collected heuristics, to obtain a pruned call and dependency graph, wherein generating the collected heuristics comprises:

obtaining a plurality of training collections of files;

for at least one training collection of files from the plurality of collections of files:

obtaining an estimated reachability of the at least one training collection of files;

executing the at least one training collection of files;

generating an initial training dependency graph of the collection of files, indicating reachability of each of the collection of files;

pruning the initial training dependency graph according to collected heuristics to obtain a pruned dependency graph indicating enhanced reachability of each of the collection of files; and

updating the collected heuristics based on differences between the reachability of at least one part of at least one file from the training collection of files and the enhanced reachability of each of the collection of files;

adding to the pruned call and dependency graph an edge that was present in the initial call and dependency graph and eliminated during said pruning;

obtaining information about vulnerabilities associated with the at least one bundle or any of the collection of entities; and

providing an indication of at least one vulnerability reachable by the pruned call and dependency graph, and at least one vulnerability unreachable by the pruned call and dependency graph.

13 . The apparatus of claim 12 , wherein adding the edge to the pruned call and dependency graph, is subject to further training that is utilized in discovering a call by a first entity to a second entity.

14 . The apparatus of claim 12 , wherein the bundle is at least one item selected from the group consisting of: a container, a virtual machine, and a file system of an operating system.

15 . The apparatus of claim 12 , wherein generating the initial call and dependency graph and pruning the initial dependency graph is performed using static analysis or reverse engineering without executing code comprised in the collection of files, and using an adaptation of “meet in the middle” approach.

16 . The apparatus of claim 12 , wherein pruning the initial call and dependency graph comprises removing vulnerabilities indicated as reachable from the initial call and dependency graph.

17 . The apparatus of claim 12 , wherein the collected heuristics are generated based also on a plurality of use cases.

18 . The apparatus of claim 12 , wherein the at least one training collection of files is a package.

19 . A computer program product comprising a non-transitory computer readable medium retaining program instructions, which instructions when read by a processor, cause the processor to perform:

obtaining a collection of entities, the collection of entities including at least one source code file and at least one non-source-code file;

identifying at least one bundle within the collection of entities;

generating a call and dependency graph of the collection of entities, wherein the graph comprises at least two nodes each associated with an entity, and at least one edge indicating a calling relationship between the at least two nodes, said generating comprising:

generating an initial call and dependency graph, indicating reachability of each of the collection of entities starting from at least one entry point; and

pruning the initial call and dependency graph by reducing at least one edge according to collected heuristics, to obtain a pruned call and dependency graph, wherein generating the collected heuristics comprises:

obtaining a plurality of training collections of files;

for at least one training collection of files from the plurality of collections of files:

obtaining an estimated reachability of the at least one training collection of files;

executing the at least one training collection of files;

generating an initial training dependency graph of the collection of files, indicating reachability of each of the collection of files;

pruning the initial training dependency graph according to collected heuristics to obtain a pruned dependency graph indicating enhanced reachability of each of the collection of files; and

updating the collected heuristics based on differences between the reachability of at least one part of at least one file from the training collection of files and the enhanced reachability of each of the collection of files;

adding to the pruned call and dependency graph an edge that was present in the initial call and dependency graph and eliminated during said pruning;

obtaining information about vulnerabilities associated with the at least one bundle or any of the collection of entities; and

providing an indication of at least one vulnerability reachable by the pruned call and dependency graph, and at least one vulnerability unreachable by the pruned call and dependency graph.

Assignments (2)

Continuity (1)

References Cited (19)